How to Remove the Greeting Card Virus

Submitted by Rick on August 27, 2007 - 10:15pm.

Adam and I first mentioned this nasty little virus earlier this spring on our radio show. The email that spreads it poses as an electronic greeting card from your friend or relative. Because the email is so poorly constructed, is never from a known address, and the link it displays in the body of the message is a number (NEVER, EVER Click a link that is constructed of a number, ex: http://91.188.176.15/) we didn't put much credence in how much damage it could do.

Unfortunately, we underestimated the sentimentality of many computer users. Many saw the words "greeting card", "friend", and/or "relative" and common sense and computer safety went out the window. They clicked on the link which then installs the virus, and a greeting card never is seen. If you have done this, and your Internet and computer seem much slower than normal, you have the greeting card virus infection. One reason for the slowness is that part of the infection involves using your computer to send out thousands of spam messages!

Here's how to remove the virus and restore order to your computer:

Download either CCleaner or CleanUp
Update your anti-virus program (hopefully you are using AVG Antivirus)
Disconnect from the Internet
Run which ever tool you downloaded in Step 1
Disable System Restore
Restart the computer in Safe Mode
Search for and delete the tcpip.sys file found in the Windows folder (usually C:\Windows\System32\Drivers)
Search for another tcpip.sys file on your computer (usually there is at least one backup somewhere)
Copy and paste this file back into: C:\Windows\System32\Drivers
Search for and delete spooldr.exe and spooldr.sys (usually found in the Windows folder or sometimes the desktop)
Run which ever tool you downloaded in Step 1 AGAIN
Run a full system scan with your antivirus program
Restart your computer normally
Connect back to the Internet
Update and run an anti-spyware program like AVG Anti-spyware, Super Anti-Spyware, SpyBot Search & Destory, etc. All these tools can be found in our Links & Resources section
After all scans have finished, turn System Restore back on again.
STOP Clicking on links in goofy emails...pay attention and be more discerning.